#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces')

## IAuthServiceKeysStore Interface

The write\-role counterpart to [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): it persists a service key at the
moment it is generated, so its public half survives even when the external keystore that holds the
private half exposes it only once\. Reading stays with [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider')\.

```csharp
public interface IAuthServiceKeysStore
```

### Remarks
The roles are segregated deliberately \(Interface Segregation\): this is NOT
`IAuthServiceKeysStore : IAuthServiceKeysProvider`\. A component that only reads keys \(the JWKS
endpoint, the token validators\) depends on the reader alone and is never coupled to persistence; the
key generator depends on the writer alone\. A persistent implementation implements BOTH role interfaces
over one durable backend, but the two contracts stay decoupled\. The durable backend, key generation,
and the rotation that advances a descriptor's status ship separately\.
### Methods

## IAuthServiceKeysStore\.AddAsync\(AuthServiceKeyDescriptor, CancellationToken\) Method {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore.AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor,System.Threading.CancellationToken)}

Persists a newly generated key with its lifecycle window, so it is available to the read seam for
verification and publication before it is ever used to sign \(publish\-before\-sign\)\.

```csharp
System.Threading.Tasks.Task AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor descriptor, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));
```
#### Parameters

###### `descriptor` [AuthServiceKeyDescriptor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore.AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor,System.Threading.CancellationToken).descriptor}

The key and the lifecycle metadata that lives around it\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore.AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor,System.Threading.CancellationToken).cancellationToken}

Cancels a network\-backed persistence round\-trip\.

#### Returns
[System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task')